Projects sharing features with Zeek Agent

OSSEC v4.1.0

go-audit is an alternative to the auditd daemon that ships with many distros

sysmon-config provides configuration templates and exclusion rule sets designed to standardize system event tracing and reduce log noise on Windows hosts. It functions as a security configuration baseline that establishes a standard for tracing system events and process behaviors. The project focuses on providing pre-defined XML filters to highlight anomalous system changes while minimizing performance impact. It utilizes a collection of exclusion rules to remove trusted processes from event logs, which improves signal quality and reduces the volume of generated security data. These configur

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

Wazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito